colin
/
UBUNTU24-CIS
mirror of https://github.com/ansible-lockdown/UBUNTU24-CIS.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
UBUNTU24-CIS/tasks/prelim.yml

320 lines
9.6 KiB
YAML
Raw Blame History

---
- name: "PRELIM | AUDIT | Set default values for facts"
ansible.builtin.set_fact:
control_1_6_1_4_was_run: false
ubtu24cis_apparmor_enforce_only: false
changed_when: false
- name: "PRELIM | AUDIT | Register if snap being used"
ansible.builtin.shell: df -h | grep -wc "/snap"
changed_when: false
failed_when: prelim_snap_pkg_mgr.rc not in [ 0, 1 ]
register: prelim_snap_pkg_mgr
tags:
- rule_1.1.1.2
- always
when:
- ubtu24cis_rule_1_1_1_6
- name: "PRELIM | AUDIT | Register if squashfs is built into the kernel"
ansible.builtin.shell: cat /lib/modules/$(uname -r)/modules.builtin | grep -c "squashfs"
changed_when: false
failed_when: prelim_squashfs_builtin.rc not in [ 0, 1 ]
register: prelim_squashfs_builtin
tags:
- always
when:
- ubtu24cis_rule_1_1_1_6
- name: "PRELIM | AUDIT | Section 1.1 | Create list of mount points"
ansible.builtin.set_fact:
mount_names: "{{ ansible_facts.mounts | map(attribute='mount') | list }}"
tags:
- always
- name: PRELIM | AUDIT | Capture tmp mount type | discover mount tmp type
when:
- "'/tmp' in mount_names"
- ubtu24cis_rule_1_1_2_1_1 or
ubtu24cis_rule_1_1_2_1_2 or
ubtu24cis_rule_1_1_2_1_3 or
ubtu24cis_rule_1_1_2_1_4
tags:
- always
block:
- name: PRELIM | AUDIT | Capture tmp mount type | discover mount tmp type
ansible.builtin.shell: systemctl is-enabled tmp.mount
register: prelim_tmp_mnt_type
changed_when: false
failed_when: prelim_tmp_mnt_type.rc not in [ 0, 1 ]
- name: PRELIM | AUDIT | Capture tmp mount type | Set to expected_tmp_mnt variable
when: "'generated' in prelim_tmp_mnt_type.stdout"
ansible.builtin.set_fact:
tmp_mnt_type: "{{ expected_tmp_mnt }}"
- name: PRELIM | AUDIT | Capture tmp mount type | Set systemd service
when: "'generated' not in prelim_tmp_mnt_type.stdout"
ansible.builtin.set_fact:
tmp_mnt_type: tmp_systemd
- name: PRELIM | Initialize the mount options variable
tags:
- always
block:
- name: PRELIM | Initializing the var if there is no /tmp mount | set_fact
when: "'/tmp' not in mount_names"
ansible.builtin.set_fact:
tmp_partition_mount_options: []
- name: PRELIM | Initializing the var if there is a /tmp mount | set_fact
when:
- item.mount == "/tmp"
- "'/tmp' in mount_names"
ansible.builtin.set_fact:
tmp_partition_mount_options: "{{ item.options.split(',') }}"
loop: "{{ ansible_facts.mounts }}"
- name: Include audit specific variables
when:
- run_audit or audit_only
- setup_audit
tags:
- setup_audit
- run_audit
ansible.builtin.include_vars:
file: audit.yml
- name: Include pre-remediation audit tasks
when:
- run_audit or audit_only
- setup_audit
tags:
- run_audit
ansible.builtin.import_tasks:
file: pre_remediation_audit.yml
- name: "PRELIM | PATCH | Run apt update"
when:
- ubtu24cis_rule_1_2_1_1 or
ubtu24cis_rule_1_2_2_1
tags:
- always
ansible.builtin.package:
update_cache: true
- name: "PRELIM | AUDIT | Wireless adapter pre-requisites"
when:
- ubtu24cis_rule_3_1_2
- not system_is_container
tags:
- always
block:
- name: "PRELIM | AUDIT | Discover is wireless adapter on system"
ansible.builtin.shell: find /sys/class/net/*/ -type d -name wireless
register: prelim_wireless_adapters
changed_when: false
failed_when: prelim_wireless_adapters.rc not in [ 0, 1 ]
- name: "PRELIM | AUDIT | If wireless adapter present capture module"
when:
- prelim_wireless_adapters.rc == 0
ansible.builtin.shell: |
for driverdir in $(find /sys/class/net/*/ -type d -name wireless | xargs -0 dirname);
do basename "$(readlink -f "$driverdir"/device/driver/module)";
done | sort -u
changed_when: false
failed_when: prelim_wireless_modules.rc not in [ 0, 1 ]
register: prelim_wireless_modules
- name: "PRELIM | PATCH | 5.3.4.5 | Find all sudoers files."
when:
- ubtu24cis_rule_5_2_4 or
ubtu24cis_rule_5_2_5
tags:
- always
ansible.builtin.shell: "find /etc/sudoers /etc/sudoers.d/ -type f ! -name '*~' ! -name '*.*'"
changed_when: false
failed_when: false
check_mode: false
register: prelim_sudoers_files
- name: "PRELIM | PATCH | Ensure conf.d directory exists required for 5.3.3.2.x"
when:
- ubtu24cis_rule_5_3_3_2_1 or
ubtu24cis_rule_5_3_3_2_2 or
ubtu24cis_rule_5_3_3_2_3 or
ubtu24cis_rule_5_3_3_2_4 or
ubtu24cis_rule_5_3_3_2_5 or
ubtu24cis_rule_5_3_3_2_6
tags:
- always
ansible.builtin.file:
path: '/etc/security/pwquality.conf.d'
state: directory
owner: root
group: root
mode: '0750'
- name: "PRELIM | AUDIT | Discover Interactive UID MIN and MIN from logins.def"
when:
- not discover_int_uid
tags:
- always
block:
- name: "PRELIM | AUDIT | Capture UID_MIN information from logins.def"
ansible.builtin.shell: grep -w "^UID_MIN" /etc/login.defs | awk '{print $NF}'
changed_when: false
register: prelim_uid_min_id
- name: "PRELIM | AUDIT | Capture UID_MAX information from logins.def"
ansible.builtin.shell: grep -w "^UID_MAX" /etc/login.defs | awk '{print $NF}'
changed_when: false
register: prelim_uid_max_id
- name: "PRELIM | AUDIT | Capture GID_MIN information from logins.def"
ansible.builtin.shell: grep -w "^GID_MIN" /etc/login.defs | awk '{print $NF}'
changed_when: false
register: prelim_gid_min_id
- name: "PRELIM | AUDIT | Set_facts for interactive uid/gid"
ansible.builtin.set_fact:
min_int_uid: "{{ prelim_uid_min_id.stdout }}"
max_int_uid: "{{ prelim_uid_max_id.stdout }}"
min_int_gid: "{{ prelim_gid_min_id.stdout }}"
- name: "PRELIM | AUDIT | Interactive Users"
tags:
- always
ansible.builtin.shell: >
grep -E -v '^(root|halt|sync|shutdown)' /etc/passwd | awk -F: '(!index($7, "sbin/nologin") && $7 != "/bin/nologin" && $7 != "/bin/false" && $7 != "/dev/null") { print $1 }'
changed_when: false
register: prelim_interactive_usernames
- name: "PRELIM | AUDIT | Interactive User accounts home directories"
tags:
- always
ansible.builtin.shell: >
grep -E -v '^(root|halt|sync|shutdown)' /etc/passwd | awk -F: '(!index($7, "sbin/nologin") && $7 != "/bin/nologin" && $7 != "/bin/false" && $7 != "/dev/null") { print $6 }'
changed_when: false
register: prelim_interactive_users_home
- name: "PRELIM | AUDIT | Interactive UIDs"
tags:
- always
ansible.builtin.shell: >
grep -E -v '^(root|halt|sync|shutdown)' /etc/passwd | awk -F: '(!index($7, "sbin/nologin") && $7 != "/bin/nologin" && $7 != "/bin/false") { print $3 }'
changed_when: false
register: prelim_interactive_uids
- name: "PRELIM | AUDIT | Gather UID 0 accounts other than root"
when:
- ubtu24cis_rule_5_4_2_1
tags:
- rule_5.4.2.1
- level1-server
- level1-workstation
- users
- always
ansible.builtin.shell: "cat /etc/passwd | awk -F: '($3 == 0 && $1 != \"root\") {i++;print $1 } END {exit i}'"
changed_when: false
check_mode: false
register: prelim_uid_zero_accounts_except_root
- name: "PRELIM | PATCH | Create journald conf.d directory"
when:
- ubtu24cis_rule_6_1_2_2 or
ubtu24cis_rule_6_1_2_3 or
ubtu24cis_rule_6_1_2_4
tags:
- always
ansible.builtin.file:
path: /etc/systemd/journald.conf.d
state: directory
owner: root
group: root
mode: '0755'
- name: "PRELIM | PATCH | Ensure auditd is installed"
when:
- ubtu24cis_rule_6_2_1_1 or
ubtu24cis_rule_6_2_4_1 or
ubtu24cis_rule_6_2_4_6 or
ubtu24cis_rule_6_2_4_8
tags:
- level2-server
- level2-workstation
- patch
- auditd
- always
block:
- name: "PRELIM | PATCH | Ensure auditd is installed"
when:
- "'auditd' not in ansible_facts.packages or
'auditd-plugins' not in ansible_facts.packages"
ansible.builtin.package:
name: ['auditd', 'audispd-plugins']
state: present
- name: "PRELIM | AUDIT | Audit conf and rules files | list files"
ansible.builtin.find:
path: /etc/audit/
file_type: file
recurse: true
patterns: '*.conf,*.rules'
register: prelim_auditd_conf_files
- name: "PRELIM | AUDIT | Check if auditd is immutable before changes"
when: "'auditd' in ansible_facts.packages"
tags:
- always
ansible.builtin.shell: auditctl -l | grep -c '-e 2'
changed_when: false
failed_when: prelim_auditd_immutable_check.rc not in [ 0, 1 ]
register: prelim_auditd_immutable_check
- name: "PRELIM | AUDIT | 6.2.4.x | Capture information about auditd logfile path | discover file"
when:
- ubtu24cis_rule_6_2_4_1 or
ubtu24cis_rule_6_2_4_2 or
ubtu24cis_rule_6_2_4_3 or
ubtu24cis_rule_6_2_4_4
tags:
- level2-server
- level2-workstation
- patch
- auditd
- rule_6.3.4.1
- rule_6.3.4.2
- rule_6.3.4.3
- rule_6.3.4.4
ansible.builtin.shell: "grep ^log_file /etc/audit/auditd.conf | awk '{ print $NF }'"
changed_when: false
failed_when: prelim_auditd_logfile.rc not in [ 0, 1 ]
register: prelim_auditd_logfile
- name: "PRELIM | PATCH | Install ACL"
when:
- ubtu24cis_rule_7_2_9
- "'acl' not in ansible_facts.packages"
tags:
- always
ansible.builtin.package:
name: acl
state: present
## Optional
- name: "Optional | PATCH | UFW firewall force to use /etc/sysctl.conf settings"
when:
- ubtu24cis_firewall_package == "ufw"
- ubtu24cis_ufw_use_sysctl
tags:
- always
ansible.builtin.lineinfile:
path: /etc/default/ufw
regexp: ^IPT_SYSCTL=.*
line: IPT_SYSCTL=/etc/sysctl.conf
mode: '0644'
Reference in New Issue View Git Blame Copy Permalink